73e1df01c1af24d9b1ba719e8201745d5c0d08e05e8dc7c0800c7c20bebc7fea

General

Target

73e1df01c1af24d9b1ba719e8201745d5c0d08e05e8dc7c0800c7c20bebc7fea
Size

1.4MB
MD5

64702781ff7844b770d10f9fd5099157
SHA1

2b0a42699e43721bbef9386330e17113e6baf8c3
SHA256

73e1df01c1af24d9b1ba719e8201745d5c0d08e05e8dc7c0800c7c20bebc7fea
SHA512

35f04889e0e3da285155bccc1281f0f7e0cd0d0ea933a8f2530d4c87ddbdf1468029bd2b3cdaa305927968998c1b992e7b4285e79cec2ebd3492727b94058b33
SSDEEP

24576:5YFEtgIZrZrRG2GWJqyUPKdIKCAqkz1IO486k+t21e37R9IQ9KyI0+SoZpkMFLDd:SqmARvUPKDqkz1I/86fb3EbSdML

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/out.upx

Files

73e1df01c1af24d9b1ba719e8201745d5c0d08e05e8dc7c0800c7c20bebc7fea
.exe windows:4 windows x86

Code Sign

2c:f0:eb:4c:28:64:53:aa:45:4f:cd:c8:ce:cb:dd:c4
Certificate

Issuer

CN=ChongZi,O=虫子,1.2.840.113549.1.9.1=#0c11313631353435373733344071712e636f6d

Not Before

26/06/2014, 02:05

Not After

31/12/2039, 23:59

Subject

CN=ChongZi,O=虫子,1.2.840.113549.1.9.1=#0c11313631353435373733344071712e636f6d

fa:a6:82:06:a1:f9:3a:37:bd:b1:93:00:c0:fd:aa:57:5d:05:95:1e
Signer

Actual PE Digest

fa:a6:82:06:a1:f9:3a:37:bd:b1:93:00:c0:fd:aa:57:5d:05:95:1e

Digest Algorithm

sha1

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 2.8MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 89KB - Virtual size: 92KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 2.8MB - Virtual size: 2.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 784KB - Virtual size: 781KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 400KB - Virtual size: 542KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 96KB - Virtual size: 93KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Code Sign

2c:f0:eb:4c:28:64:53:aa:45:4f:cd:c8:ce:cb:dd:c4Certificate

fa:a6:82:06:a1:f9:3a:37:bd:b1:93:00:c0:fd:aa:57:5d:05:95:1eSigner

Headers

File Characteristics

Sections

UPX0 Size: - Virtual size: 2.8MB

UPX1 Size: 1.3MB - Virtual size: 1.3MB

.rsrc Size: 89KB - Virtual size: 92KB

Headers

File Characteristics

Sections

.text Size: 2.8MB - Virtual size: 2.8MB

.rdata Size: 784KB - Virtual size: 781KB

.data Size: 400KB - Virtual size: 542KB

.rsrc Size: 96KB - Virtual size: 93KB

2c:f0:eb:4c:28:64:53:aa:45:4f:cd:c8:ce:cb:dd:c4
Certificate

fa:a6:82:06:a1:f9:3a:37:bd:b1:93:00:c0:fd:aa:57:5d:05:95:1e
Signer

UPX0
Size: - Virtual size: 2.8MB

UPX1
Size: 1.3MB - Virtual size: 1.3MB

.rsrc
Size: 89KB - Virtual size: 92KB

.text
Size: 2.8MB - Virtual size: 2.8MB

.rdata
Size: 784KB - Virtual size: 781KB

.data
Size: 400KB - Virtual size: 542KB

.rsrc
Size: 96KB - Virtual size: 93KB